RAN SP T O L R A T National Transportation Safety Board RI LUBUS A N PUNUM E O T

I

I O

T Washington, D.C. 20594

A N

N

S

A D FE R TYBOA Safety Recommendation

Date: April 11, 2000 In reply refer to: A-00-30 and -31

Honorable Jane Garvey Administrator Federal Aviation Administration Washington, D.C. 20591

In this letter, the National Transportation Safety Board recommends that the Federal Aviation Administration (FAA) take actions to address safety issues concerning the current lack of cockpit imagery and the location of flight recorder circuit breakers. These recommendations were prompted by the lack of valuable cockpit information during the investigations of several aircraft incidents and accidents, including USAir flight 105 on September 8, 1989, ValuJet flight 592 on May 11, 1996, SilkAir flight 185 on December 19, 1997, Swissair flight 111 on September 2, 1998, and EgyptAir flight 990 on October 31, 1999. This letter summarizes the Safety Board’s rationale for issuing the recommendations.

In its report on the September 8, 1989, incident involving USAir flight 105, a Boeing 737, at Kansas City, Missouri, the Safety Board cited the need for a video recording of the cockpit environment.1 The report pointed out the limitations of existing flight recorders to fully document the range of the flight crew actions and communications. It also noted that the introduction of aircraft with electronic “glass” cockpits and the use of data link communications would enable the flight crew to make display and data retrieval selections that will be transparent to the cockpit voice recorder (CVR) and digital flight data recorder (DFDR). The Safety Board indicated that it would monitor and evaluate progress in the application of video technology to the cockpits of air transports. In the 9 years since that incident, considerable progress has been made in video and flight recorder technologies, and the need for video recording has become more evident. Electronic image recording of the cockpit environment is now both technologically and economically feasible.

On May 11, 1996, the crew of ValuJet flight 592, a DC-9-32, reported smoke and fire shortly after departing Miami, Florida. The flight recorders stopped about 40 to 50 seconds before the airplane crashed on its return to the airport, killing all 111 passengers and crew. The exact smoke and fire conditions that were present in the cockpit during the last few minutes of flight are not known.

1 National Transportation Safety Board. 1990. USAir Flight 105, Boeing 737-200, N283AU, Kansas City International Airport, Missouri, September 8, 1989. Aircraft Incident Report NTSB/AAR-90/04. Washington, DC.

7249 2

On December 19, 1997, SilkAir flight 185, a Boeing 737, entered a rapid descent from 35,000 feet, which ended with a high speed impact in the Sumatran River near Palembang, Indonesia. There were 104 fatalities. The Indonesian investigation, in which the Safety Board participated, determined that both flight recorders stopped prior to the airplane entering the rapid descent. The lack of recorded information concerning the circumstances in the cockpit has continued to hamper the investigation.

On September 2, 1998, Swissair flight 111, an MD-11, on a regularly scheduled passenger flight from New York to Geneva, Switzerland, diverted to Halifax after the crew reported smoke in the cockpit; the airplane crashed into the waters near Peggy’s Cove, Nova Scotia, killing all 229 passengers and crew on board. The exact cockpit smoke and fire conditions that led to the crew’s decision to descend from cruise flight and to divert to Halifax is unknown.

On October 31, 1999, EgyptAir flight 990, a Boeing 767-366-ER, on a scheduled international flight from New York to Cairo, crashed in the Atlantic Ocean about 60 miles south of Nantucket Island, Massachusetts, killing all 217 passengers and crew. The Safety Board investigators, in close cooperation with Egyptian government officials, are trying to determine the circumstances that caused the aircraft to descend from its cruising altitude and to impact the ocean. The DFDR and CVR yielded some information, but questions still remain as to the exact environment in the cockpit prior to the upset.

These accidents are just the most recent in a long history of accident and incident investigations that might have benefited from the capture of a graphic record of the cockpit environment. Reconstructing the events that led to many accidents has been difficult for investigators because of limited data. This lack of information was evident during the ValuJet investigation. Although the conventional CVR and DFDR recorded sounds and relatively comprehensive airplane data at the time of the initial fire, they did not show the cockpit environmental conditions that the flight crew faced during the initial portion of the fire. This information is critical in determining whether the crew had subtle indications of smoke or fire, whether they followed procedures, or whether or not their actions were effective in clearing smoke from the cockpit. If the conditions were known, it might be possible to modify aircraft systems or training programs to assist future crews in recognizing these indications and effecting a safe recovery.

The Swissair MD-11 accident was very similar to the ValuJet accident, except the fire is not believed to have progressed as quickly, giving the crew more time to attempt to effect a safe recovery. However, the lack of cockpit imagery has resulted in many unanswered questions about the origin of the fire, the first indications of a fire in the cockpit, the procedures used, and the effectiveness of the procedures in clearing smoke from the cockpit. Questions also remain regarding the progression of the fire, the availability of critical flight instruments, and whether the crew was overcome or debilitated by the smoke and fire during the final minutes of the flight.

The Safety Board’s current investigation of the crash of EgyptAir flight 990, a Boeing 767 aircraft, further highlights the need for electronic cockpit imagery on commercial transport aircraft. Even though the aircraft was equipped with a 30-minute CVR and a DFDR that sampled 3 over 150 parameters, the Safety Board is concerned that the full circumstances that led to the descent into the ocean may never be fully understood because of the lack of electronic cockpit imagery. The data appear to indicate that the flight was proceeding normally at about 33,000 feet until the autopilot disconnected. About 8 seconds later, a large nose-down elevator deflection and reduction of power to both engines were recorded, and the airplane began a rapid descent. During this descent, the airplane reached a maximum nose-down pitch angle of about 40º. The last few seconds of the data recorder showed that the pitch attitude of the aircraft rose to about 10º nose down. It also showed an elevator split in the last 15 seconds, during which the No. 1 elevator (left, or captain’s side) was in the nose-up position, while the No. 2 elevator (right, first officer’s side) was in the nose-down position. The maximum split between the elevators during that period was about 7º. In the last second of data, the elevator split appeared to be lessening. DFDR parameters “engine start lever,” both left and right, changed from “run” to “cut-off.” The changes in these and other engine parameters are consistent with both engines shutting down. Also, the speed brake handle moved from the stowed position to the deployed position. The origins of the actions, as well as the circumstances prompting the actions, that resulted in the changes in the aircraft’s controls may never be definitively resolved because of the lack of electronic images of the cockpit. The Safety Board continues to actively gather more information in an attempt to answer the unresolved questions, but the Board does not have any direct evidence of these actions in the cockpit.

The international aviation community is aware of the safety benefits of crash-protected video recorders. Agenda item 3 of ICAO’s FLIRECP/22 specifically dealt with the need for standards and recommended practices (SARPs) concerning video recordings. The panel agreed that the use of video recordings in aircraft cockpits would be very useful and noted that EUROCAE3 was developing minimum operational performance specifications (MOPS). The panel agreed that video technology was maturing to the point where specific technical aspects (for example, frame rate, number of cameras, and resolution per frame) must be determined, and that the ongoing work of EUROCAE and ARINC4 should be considered when developing video recorder SARPs. The panel concluded that it was “strongly committed to the introduction of video recordings in an appropriate and agreed format, and that this should form part of the future work of the panel.”

EUROCAE Working Group 50 (WG50) began drafting the fundamental needs for video recorders at its February 1999 meeting, which was attended by recorder manufacturers, regulatory authorities, and accident investigators from around the world, including the Safety Board and the FAA. On February 8, 2000, the Safety Board issued Safety Recommendation A- 99-59, which asked the FAA to incorporate EUROCAE’s performance standards for a crash- protected video recording system into a technical standard order (TSO).5 Given that the

2 International Civil Aviation Organization (ICAO), Flight Recorder Panel second meeting (FLIRECP/2), November 1998. 3 European Organization for Civil Aviation Equipment (EUROCAE). 4 ARINC, located in Annapolis, Maryland, is a private corporation whose principal stockholders are international air carriers. ARINC provides the aviation industry with communications and information processing systems and services, system engineering, and standards. 5 The current status of Safety Recommendation A-99-59 is “Open—Await Response.” 4 fundamental needs for cockpit image recording are expected to be finalized by WG50 during the first half of 2000, the Safety Board encourages the FAA to work with EUROCAE to help expedite the finalization of the WG50 MOPS and to incorporate the performance standards defined in the MOPS into an FAA TSO for a crash-protected cockpit image recording system as soon as practicable.

The unresolved issues in the EgyptAir investigation regarding the circumstances and actions taken in the cockpit could exist in any transport category aircraft. Cockpit imagery would provide key information that cannot be obtained from a CVR or a DFDR regarding the cockpit environment and actions taken within the cockpit, including those prompted by nonverbal communications. Therefore, in order to document the conditions that occur in a cockpit prior to an accident, the Safety Board believes that all aircraft operated under Title 14 Code of Federal Regulations Part 121, 125, or 135, and required to be equipped with a CVR and DFDR should also be equipped with a crash-protected cockpit image recorder of a 2-hour minimum duration.

With the experience that the Safety Board has gained during the EgyptAir investigation, the Board believes that the critical elements which need to be recorded by a cockpit image recorder include the identities, locations, and actions of the people in the cockpit. The camera(s) do not have to be mounted such that they are pointed at the faces of the crew while in flight. Color images are required to clearly discern instrument readings. In glass cockpits, color is used to provide additional information, such as warnings and status. The color image of the cockpit must, at a minimum, be able to document where all of the crewmembers are at any given time while in the cockpit. In addition, a color image of the flight control positions and exact crew movements must be documented. All views must be captured under all lighting conditions, including bright sunlight and darkness. The number of cameras used should be the number necessary to adequately capture these color images.

The process of capturing and recording an electronic image is subject to many factors. These factors affect the viewer’s ability to discern motion of an object. They also affect how clearly the object can be distinguished from the general background scene. Among the key factors in determining the overall quality of digital imagery are frame rate, resolution, camera position, lighting, lens type, and the compression algorithm used on the data.

The Safety Board understands that the EUROCAE specifications will define several of these key factors, including frame rate and resolution. The Safety Board recognizes that because of technical considerations, the minimum frame rate will be less than the typical 30 frames per second in the video industry. However, the Board believes that the frame rate combined with the minimum resolution must be sufficient to capture actions, such as display selections or system activations, during the crucial final portion of the recording. Given a 2-hour recording requirement, the Safety Board further recognizes that a tradeoff of frame rate, resolution, and recorder memory may be necessary. For example, the final 30 minutes of recording might have a higher frame rate than the earlier 90 minutes of recording, which might have a reduced resolution or minimum frame rate that is still sufficient to determine motion. The remainder of the specifications should be mixed appropriately in order to achieve the required cockpit imagery under all lighting scenarios, and for a sufficient recording duration. 5

A strong justification for the use of cockpit image recorders involves the expected future requirement to record data link communications. By about 2004, analog CVRs will no longer meet the requirements for aircraft using controller-pilot data link (CPDL) communications. It is anticipated that future regulatory changes will require that aircraft using CPDL communications be outfitted with some means of recording this information.6 To that end, the Safety Board encourages industry to consider the use of cockpit image recorder technology as a means of compliance on airplanes using CPDL communications. Adding a properly placed cockpit video camera would allow data link messages displayed to the crew to be recorded on the image recorder. The use of video technology would not require any modifications to the existing aircraft’s communication or display systems. This might greatly reduce the time and expense of retrofitting older aircraft to record CPDL messages.

The installation of a cockpit image recording system to most aircraft would probably necessitate adding an additional recorder unit to the aircraft. In a March 9, 1999, letter to the FAA, the Safety Board recommended that a 10-minute auxiliary power source be required for existing CVRs and that all newly manufactured aircraft be equipped with two combination CVR/DFDR recording systems, one located in the front of the aircraft and the other located as far aft as possible (Safety Recommendations A-99-16 and -17).7 The Safety Board believes that these same arguments also apply to a cockpit image recorder, which could, in some investigations, be the primary tool in documenting the circumstances leading up to the accident or incident; consequently, the same 10-minute independent power requirement should be mandatory in any image recorder installation. Several of the recorder manufacturers are considering designs that would incorporate all of the recording requirements in one box. These designs would be capable of recording the audio (CVR function), the data (the DFDR function), the CPDL, and image functions in one self-contained unit (CVR/DFDR/IMAGE). The Safety Board believes that this type of multi-function recording unit would provide the maximum reliability and redundancy needed for a newly manufactured, modern aircraft.

There are other issues of importance to the Safety Board with regard to the addition of a cockpit image recorder system. One issue is the need to time-synchronize CVR, DFDR, and cockpit image recorders. The use of a combination CVR/DFDR/IMAGE unit will accomplish this synchronization and provide a common time reference.

Another issue is the location of the circuit breaker for the cockpit image recorder system. To ensure that the recording of images cannot be selectively disabled (by cockpit crews), the Safety Board believes it should not be possible to access the circuit breaker for the cockpit image recorder system in the cockpit during flight. Initially, it was believed that in order to prevent in- flight incidents from being overwritten on the flight recorders, particularly on 30-minute CVRs, that it was necessary to have the flight recorder circuit breakers accessible in the cockpit to allow for them to be turned off to preserve the recorded information. However, the Safety Board has been involved in a recent accident investigation in which it has become evident that the

6 The FAA has indicated that it will initiate rulemaking to clarify that the present requirement to record all voice messages be expanded to include cockpit data messages. According to the FAA, the rulemaking is expected to take effect about 2004. 7 The current status of Safety Recommendations A-99-16 and -17 is “Open—Acceptable Response.” 6

accessibility of the circuit breakers may have played a role in the recorders stopping before impact. In the SilkAir accident, the CVR stopped recording 5 minutes 58 seconds prior to the DFDR, which stopped 1 minute 54 seconds prior to impact. Investigators have been unable to find any indications of problems or possible failure modes that would have led to the CVR and the DFDR stopping at different times before impact. One possible explanation would be that the circuit breakers were pulled from within the cockpit. Given the possibility of a situation such as this occurring and the pending rulemaking to require 2-hour CVRs, the Safety Board believes that circuit breakers for all CVRs, DFDRs, and cockpit image recorders should be inaccessible during flight.

The following list summarizes the Safety Board’s minimum requirements for a cockpit image recorder: · Recording duration should be 2 hours. · Color images should be recorded from all cameras. · Recorded images should be captured under all lighting conditions. · The entire cockpit image should be recorded, including views of each control position and actions taken by people in the cockpit. · The number of cameras should be the number necessary to adequately capture these images. · The frame rate and resolution should be sufficient to capture motion and critical actions, such as display selections or system activations. · The recorder should have an independent power supply capable of providing power for 10 minutes. · Circuit breakers should be inaccessible during flight.

In the 1960s, the bold support of the airline pilots and the wisdom of the aviation community were instrumental in ensuring that accurate, complete information of cockpit communications was secured for accident prevention purposes. Many of the advances in aviation safety since that time can be directly traced to the visionary installation of CVRs and the crucial information captured by these devices. Imaging technology has advanced to the point where the aviation community is now on the threshold of a new generation of recorders that will lead to even greater understanding of the root causes of accidents and build upon the solid safety foundation that has been made possible by CVRs.

The Safety Board recognizes the privacy issues with recording images of pilots. However, the Board believes that given the history of complex accident investigations and lack of crucial information regarding the cockpit environment, the safety of the flying public must take precedence. In the interest of protecting the use of any recorded images, the Safety Board has requested that Congress implement the same provisions that exist for CVRs for the use of image recorders in all modes of transportation. Pending authorization, a cockpit image recorder would be protected by the Safety Board in the same rigorous manner as a CVR. 7

Safety Recommendation A-99-16, mentioned earlier in this letter, asked that all existing flight recorders be retrofitted with an auxiliary power supply, and also that a 2-hour CVR be installed by January 1, 2005. The Safety Board believes this date is also appropriate for the incorporation of crash-protected cockpit image recorders. Therefore, the Safety Board believes that the FAA should require that all aircraft operated under Part 121, 125, or 135 and currently required to be equipped with a CVR and DFDR be retrofitted by January 1, 2005, with a crash- protected cockpit image recording system. The cockpit image recorder system should have a 2- hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. The cockpit image recorder should be mounted in the aft portion of the aircraft for maximum survivability and should be equipped with an independent auxiliary power supply that automatically engages and provides 10 minutes of operation whenever aircraft power to the cockpit image recorder and associated cockpit camera system ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder system, as well as the circuit breakers for the CVR and the DFDR, should not be accessible to the flight crew during flight.

For newly manufactured aircraft, the recommended time frame for equipping aircraft with two combination CVR/DFDR recording systems and an auxiliary power supply was January 1, 2003 (Safety Recommendation A-99-17). As previously mentioned, the technology currently exists to incorporate CVR, DFDR, and image recording functions in a single unit. Therefore, the Safety Board believes that the FAA should require that all aircraft manufactured after January 1, 2003, operated under Part 121, 125, or 135 and required to be equipped with a CVR and DFDR also be equipped with two crash-protected cockpit image recording systems. The cockpit image recorder systems should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. One recorder should be located as close to the cockpit as practicable and the other as far aft as practicable. These recorders should be equipped with independent auxiliary power supplies that automatically engage and provide 10 minutes of operation whenever aircraft power to the cockpit image recorders and associated cockpit camera systems ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder systems, as well as the circuit breakers for the CVRs and the DFDRs, should not be accessible to the flight crew during flight. 8

Therefore, the National Transportation Safety Board recommends that the Federal Aviation Administration:

Require that all aircraft operated under Title 14 Code of Federal Regulations Part 121, 125, or 135 and currently required to be equipped with a cockpit voice recorder (CVR) and digital flight data recorder (DFDR) be retrofitted by January 1, 2005, with a crash-protected cockpit image recording system. The cockpit image recorder system should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. The cockpit image recorder should be mounted in the aft portion of the aircraft for maximum survivability and should be equipped with an independent auxiliary power supply that automatically engages and provides 10 minutes of operation whenever aircraft power to the cockpit image recorder and associated cockpit camera system ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder system, as well as the circuit breakers for the CVR and the DFDR, should not be accessible to the flight crew during flight. (A-00-30)

Require that all aircraft manufactured after January 1, 2003, operated under Title 14 Code of Federal Regulations Part 121, 125, or 135 and required to be equipped with a cockpit voice recorder (CVR) and digital flight data recorder (DFDR) also be equipped with two crash-protected cockpit image recording systems. The cockpit image recorder systems should have a 2-hour recording duration, as a minimum, and be capable of recording, in color, a view of the entire cockpit including each control position and each action (such as display selections or system activations) taken by people in the cockpit. The recording of these video images should be at a frame rate and resolution sufficient for capturing such actions. One recorder should be located as close to the cockpit as practicable and the other as far aft as practicable. These recorders should be equipped with independent auxiliary power supplies that automatically engage and provide 10 minutes of operation whenever aircraft power to the cockpit image recorders and associated cockpit camera systems ceases, either by normal shutdown or by a loss of power to the bus. The circuit breaker for the cockpit image recorder systems, as well as the circuit breakers for the CVRs and the DFDRs, should not be accessible to the flight crew during flight. (A-00-31) 9

Chairman HALL, and Members HAMMERSCHMIDT, GOGLIA, and BLACK concurred in these recommendations.

By: Jim Hall Chairman